Skip to content

Commit 70f413c

Browse files
rubenvp8510max-cx
rubenvp8510
authored and
max-cx
committed
OBSDOCS-1976: Document support for GCP, Azure, and AWS STP tokens
Signed-off-by: Ruben Vargas <[email protected]>
1 parent cce7f17 commit 70f413c

4 files changed

+340
-0
lines changed

‎modules/distr-tracing-tempo-object-storage-setup-aws-sts-cco-install.adoc

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
// Module included in the following assemblies:
2+
//
3+
//* observability/distr_tracing/distr-tracing-tempo-installing.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="distr-tracing-tempo-object-storage-setup-aws-sts-install_{context}"]
7+
= Setting up the Amazon S3 storage with the Security Token Service
8+
9+
You can set up the Amazon S3 storage with the Security Token Service (STS) by using the AWS Command Line Interface (AWS CLI).
10+
11+
:FeatureName: The Amazon S3 storage with the Security Token Service
12+
include::snippets/technology-preview.adoc[leveloffset=+1]
13+
14+
.Prerequisites
15+
16+
* You have installed the latest version of the AWS CLI.
17+
* You have installed and configured Cloud Credential Operator in your cluster.
18+
19+
.Procedure
20+
21+
. Create an AWS S3 bucket.
22+
23+
. Create the following `trust.json` file for the AWS IAM policy that will set up a trust relationship for the AWS IAM role, created in the next step, with the service account of the TempoStack instance:
24+
+
25+
[source,yaml]
26+
----
27+
{
28+
"Version": "2012-10-17",
29+
"Statement": [
30+
{
31+
"Effect": "Allow",
32+
"Principal": {
33+
"Federated": "arn:aws:iam::${<aws_account_id>}:oidc-provider/${<oidc_provider>}" # <1>
34+
},
35+
"Action": "sts:AssumeRoleWithWebIdentity",
36+
"Condition": {
37+
"StringEquals": {
38+
"${OIDC_PROVIDER}:sub": [
39+
"system:serviceaccount:${<openshift_project_for_tempostack>}:tempo-${<tempostack_cr_name>}" # <2>
40+
"system:serviceaccount:${<openshift_project_for_tempostack>}:tempo-${<tempostack_cr_name>}-query-frontend"
41+
]
42+
}
43+
}
44+
}
45+
]
46+
}
47+
----
48+
<1> OIDC provider that you have configured on the {product-title}. You can get the configured OIDC provider value also by running the following command: `$ oc get authentication cluster -o json | jq -r '.spec.serviceAccountIssuer' | sed 's~http[s]*://~~g'`.
49+
<2> Namespace in which you intend to create the TempoStack instance.
50+
51+
. Create an AWS IAM role by attaching the `trust.json` policy file that you created:
52+
+
53+
[source,terminal]
54+
----
55+
$ aws iam create-role \
56+
--role-name "tempo-s3-access" \
57+
--assume-role-policy-document "file:///tmp/trust.json" \
58+
--query Role.Arn \
59+
--output text
60+
----
61+
62+
. Attach an AWS IAM policy to the created role:
63+
+
64+
[source,terminal]
65+
----
66+
$ aws iam attach-role-policy \
67+
--role-name "tempo-s3-access" \
68+
--policy-arn "arn:aws:iam::aws:policy/AmazonS3FullAccess"
69+
----
70+
. Configure Cloud Provider environment for the tempo operator. In the case of AWS STS we need to add ROLEARN environment variable to the operator subcription.
71+
[source,terminal]
72+
----
73+
$ oc patch subscription <TEMPO_OPERATOR_SUB> \ <1>
74+
-n <TEMPO_OPERATOR_NAMESPACE> \ <2>
75+
--type='merge' -p '{"spec": {"config": {"env": [{"name": "ROLEARN", "value": "'"<ROLE_ARN>"'"}]}}}' <3>
76+
77+
----
78+
<1> Operator Subscription Name
79+
<2> Tempo Operator namespace
80+
<3> ARN of the role previously created.
81+
82+
. In the {product-title}, create an object storage secret with keys as follows:
83+
+
84+
[source,yaml]
85+
----
86+
apiVersion: v1
87+
kind: Secret
88+
metadata:
89+
name: minio-test
90+
stringData:
91+
bucket: <s3_bucket_name>
92+
region: <s3_region>
93+
type: Opaque
94+
----
95+
. When TempoStack CR is created you need to specify the credentialMode as follows:
96+
[source,yaml]
97+
----
98+
apiVersion: tempo.grafana.com/v1alpha1
99+
kind: TempoStack
100+
metadata:
101+
name: <name>
102+
namespace: <tempo_ns>
103+
spec:
104+
storage:
105+
secret:
106+
name: aws-sts
107+
type: s3 <1>
108+
credentialMode: token-cco <2>
109+
----
110+
<1> Currently this is the only backend supported togheter with CCO.
111+
<2> Credential mode should be set to token-cco.
112+
+
113+
. For tempo monolithic will be similar:
114+
[source,yaml]
115+
----
116+
apiVersion: tempo.grafana.com/v1alpha1
117+
kind: TempoMonolithic
118+
metadata:
119+
name: <name>
120+
namespace: <tempo_ns>
121+
spec:
122+
storage:
123+
traces:
124+
backend: s3 <1>
125+
s3:
126+
secret: aws-sts
127+
credentialMode: token-cco <2>
128+
----
129+
<1> Currently this is the only backend supported togheter with CCO.
130+
<2> Credential mode should be set to token-cco.

‎modules/distr-tracing-tempo-object-storage-setup-azure-sts-install.adoc

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
// Module included in the following assemblies:
2+
//
3+
//* observability/distr_tracing/distr-tracing-tempo-installing.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="distr-tracing-tempo-object-storage-setup-azure-sts-install_{context}"]
7+
= Setting up the Azure storage with the Security Token Service
8+
9+
You can set up Azure storage with the Security Token Service (STS) by using the Azure Command Line Interface (AZ CLI).
10+
11+
:FeatureName: Azure storage with the Security Token Service
12+
include::snippets/technology-preview.adoc[leveloffset=+1]
13+
14+
.Prerequisites
15+
16+
* You have installed the latest version of the AWS CLI.
17+
* Created an Azure Storage Account.
18+
* Created an Azure Blob Storage Container.
19+
20+
.Procedure
21+
. Create an Azure Managed identity
22+
[source,terminal]
23+
----
24+
az identity create \
25+
--name <IDENTITY_NAME> \ <1>
26+
--resource-group <RESOURCE_GROUP> \ <2>
27+
--location <REGION> \ <3>
28+
--subscription <SUBSCRIPTION_ID> <4>
29+
----
30+
<1> Name of the identity to be created.
31+
<2> The Azure resource group where the identity will be created.
32+
<3> The Azure region; it should be the same region as the resource group.
33+
<4> Azure subscription ID.
34+
+
35+
. Create federated credentials. Federated credentials allow Kubernetes service accounts to authenticate as the Azure managed identity without storing secrets or using service principals. You need to create one per Kubernetes service account. In this case, the operator will create one service account for all components and one specific for the frontend component.
36+
[source,terminal]
37+
----
38+
az identity federated-credential create \
39+
--name <CREDENTIAL_NAME> \ <1>
40+
--identity-name <IDENTITY_NAME> \
41+
--resource-group <RESOURCE_GROUP> \
42+
--issuer <CLUSTER_ISSUER> \ <2>
43+
--subject <TEMPO_SA_SUBJECT> \ <3>
44+
--audiences <AUDIENCE> <4>
45+
----
46+
<1> Name of the federated credential.
47+
<2> The OIDC issuer URL of the Kubernetes cluster. You can get it using the following command: `oc get authentication cluster -o json | jq -r .spec.serviceAccountIssuer`
48+
<3> The Kubernetes service account subject, in the format: `system:serviceaccount:<namespace>:tempo-<tempo-instance-name>`
49+
<4> The expected audience used to validate tokens, commonly set to `api://AzureADTokenExchange`.
50+
+
51+
Create frontend federated credential.
52+
[source,terminal]
53+
----
54+
az identity federated-credential create \
55+
--name <CREDENTIAL_NAME>-frontend \ <1>
56+
--identity-name <IDENTITY_NAME> \
57+
--resource-group <RESOURCE_GROUP> \
58+
--issuer <CLUSTER_ISSUER> \
59+
--subject <TEMPO_SA_QUERY_FRONTEND_SUBJECT> \ <2>
60+
--audiences <AUDIENCE> | jq
61+
----
62+
<1> Name of the federated credential.
63+
<2> The Kubernetes service account subject, in the format: `system:serviceaccount:<namespace>:tempo-<tempo-instance-name>`
64+
+
65+
. Assign the "Storage Blob Data Contributor" role to the managed identity's service principal.
66+
[source,terminal]
67+
----
68+
az role assignment create \
69+
--assignee <ASSIGNEE_NAME> \ <1>
70+
--role "Storage Blob Data Contributor" \
71+
--scope "/subscriptions/<SUBSCRIPTION_ID>
72+
----
73+
<1> Managed identity principal. Can be obtained with the following command: `az ad sp list --all --filter "servicePrincipalType eq 'ManagedIdentity'" | jq -r --arg idName <IDENTITY_NAME> '.[] | select(.displayName == $idName) | .appId'`
74+
+
75+
. Fetch the client ID of the existing managed identity.
76+
[source,terminal]
77+
----
78+
CLIENT_ID=$(az identity show \
79+
--name <IDENTITY_NAME> \
80+
--resource-group <RESOURCE_GROUP> \
81+
--query clientId \
82+
-o tsv)
83+
----
84+
+
85+
. Create a Kubernetes secret for Azure WIF.
86+
[source,terminal]
87+
----
88+
kubectl create -n <TEMPO_NAMESPACE> secret generic azure-secret \
89+
--from-literal=container=<$AZURE_STORAGE_AZURE_CONTAINER> \ <1>
90+
--from-literal=account_name=<AZURE_STORAGE_AZURE_ACCOUNTNAME> \ <2>
91+
--from-literal=client_id=<CLIENT_ID> \ <3>
92+
--from-literal=audience=<AUDIENCE> \ <4>
93+
--from-literal=tenant_id=<TENANT_ID> <5>
94+
----
95+
<1> Azure Blob storage container.
96+
<2> Azure Storage account name.
97+
<3> Client ID of the managed identity (obtained in the previous step).
98+
<4> Audience, optional (defaults to `api://AzureADTokenExchange`).
99+
<5> Azure Tenant ID.

‎modules/distr-tracing-tempo-object-storage-setup-gcp-sts-install.adoc

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
// Module included in the following assemblies:
2+
//
3+
//* observability/distr_tracing/distr-tracing-tempo-installing.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="distr-tracing-tempo-object-storage-setup-gcp-sts-install_{context}"]
7+
= Setting up the Google Cloud storage with the Security Token Service
8+
9+
You can set up the Goocle Cloud Storage with the Security Token Service (STS) by using the Google Coud CLI.
10+
11+
:FeatureName: The Amazon GCS storage with the Security Token Service
12+
include::snippets/technology-preview.adoc[leveloffset=+1]
13+
14+
.Prerequisites
15+
16+
* You have installed the latest version of the Google Cloud CLI.
17+
18+
.Procedure
19+
20+
. Create an GCS bucket.
21+
22+
. Create an IAM service account. You can also use any existing IAM service account in any project in your organization.
23+
24+
+
25+
[source,terminal]
26+
----
27+
SERVICE_ACCOUNT_EMAIL=$(gcloud iam service-accounts create <IAM_SA_NAME> \ #<1>
28+
--display-name="Tempo Account" \
29+
--project <PROJECT_ID> \ #<2>
30+
--format='value(email)' \
31+
--quiet)
32+
----
33+
<1> Service account name in Google Cloud.
34+
<2> Google Cloud Project ID in which the account will be created
35+
36+
. Bind the required GCP roles to the created SA at the project level:
37+
+
38+
[source,terminal]
39+
----
40+
$ gcloud projects add-iam-policy-binding <PROJECT_ID> \
41+
--member "serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
42+
--role="roles/iam.workloadIdentityUser"
43+
44+
$ gcloud projects add-iam-policy-binding <PROJECT_ID> \
45+
--member "serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
46+
--role "roles/storage.objectAdmin"
47+
48+
----
49+
. Retrieve the `POOL_ID` of the Google Cloud Workload Identity Pool associated with the OpenShift cluster.
50+
+
51+
[source,terminal]
52+
----
53+
$ OIDC_ISSUER=$(oc get authentication.config cluster -o jsonpath='{.spec.serviceAccountIssuer}')
54+
55+
$ POOL_ID=$(echo "$OIDC_ISSUER" | awk -F'/' '{print $NF}' | sed 's/-oidc$//')
56+
----
57+
. Allow Kubernetes Service Accounts to impersonate the Google Service Account, SERVICE_ACCOUNT_EMAIL is the output of the commant used to created the service account in the step 2.
58+
+
59+
[source,terminal]
60+
----
61+
$ gcloud iam service-accounts add-iam-policy-binding "$SERVICE_ACCOUNT_EMAIL" \
62+
--role="roles/iam.workloadIdentityUser" \
63+
--member="principal://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<POOL_ID>/subject/system:serviceaccount:<TEMPO_NAMESPACE>:tempo-<TEMPO_NAME>" \
64+
--project=<PROJECT_ID> \
65+
--quiet
66+
67+
$ gcloud iam service-accounts add-iam-policy-binding "$SERVICE_ACCOUNT_EMAIL" \
68+
--role="roles/iam.workloadIdentityUser" \
69+
--member="principal://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/subject/system:serviceaccount:${TEMPO_NAMESPACE}:tempo-${TEMPO_NAME}-query-frontend" \
70+
--project="$PROJECT_ID" \
71+
--quiet
72+
----
73+
. Create credential file used by Tempo Stack, this will be in the key.json key in the storage secret:
74+
+
75+
[source,terminal]
76+
----
77+
$ gcloud iam workload-identity-pools create-cred-config \
78+
"projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/$POOL_ID/providers/<PROVIDER_ID>" \
79+
--service-account="$SERVICE_ACCOUNT_EMAIL" \
80+
--credential-source-file=/var/run/secrets/storage/serviceaccount/token \
81+
--credential-source-type=text \
82+
--output-file=<OUTPUT_FILE_PATH> #<1>
83+
----
84+
<1> Path where the file will be writed
85+
+
86+
Note: credential-source-file should be always point to /var/run/secrets/storage/serviceaccount/token, this is where the operator will mount the token
87+
. Get the correct audience as follows:
88+
+
89+
[source,terminal]
90+
----
91+
gcloud iam workload-identity-pools providers describe "$PROVIDER_NAME" --format='value(oidc.allowedAudiences[0])'
92+
----
93+
+
94+
. Create storage secret to be used by Tempo.
95+
+
96+
[source,terminal]
97+
----
98+
kubectl -n <TEMPO_NAMESPACE> create secret generic gcs-secret \
99+
--from-literal=bucketname="<BUCKET_NAME> \ #<1>
100+
--from-literal=audience="<AUDIENCE> \ #<2>
101+
--from-file=key.json=<OUTPUT_FILE_PATH> #<3>
102+
----
103+
<1> Bucket name of the Google Cloud Storage
104+
<2> Audience we get in the previous step
105+
<3> This is the file we created with gcloud iam workload-identity-pools create-cred-config command.

‎observability/distr_tracing/distr-tracing-tempo-installing.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,12 @@ include::modules/distr-tracing-tempo-storage-ref.adoc[leveloffset=+1]
3838

3939
include::modules/distr-tracing-tempo-object-storage-setup-aws-sts-install.adoc[leveloffset=+2]
4040

41+
include::modules/distr-tracing-tempo-object-storage-setup-azure-sts-install.adoc[leveloffset=+2]
42+
43+
include::modules/distr-tracing-tempo-object-storage-setup-gcp-sts-install.adoc[leveloffset=+2]
44+
45+
include::modules/distr-tracing-tempo-object-storage-setup-aws-sts-cco-install.adoc[leveloffset=+2]
46+
4147
[role="_additional-resources"]
4248
.Additional resources
4349

0 commit comments

Comments
 (0)